Coherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying
aa r X i v : . [ qu a n t - ph ] D ec Coherent State Quantum Key Distribution withMulti Letter Phase-Shift Keying
Denis Sych and Gerd Leuchs
Max Planck Institut f¨ur die Physik des Lichts, G¨unther–Scharowsky–Strasse 1 /Bau24, D-91058 Erlangen, GermanyInstitut f¨ur Optik, Information und Photonik, Universit¨at Erlangen–N¨urnberg,Staudtstrasse 7 / B2, 91058 Erlangen, Germany
Abstract.
We present a protocol for quantum key distribution using discretemodulation of coherent states of light. Information is encoded in the variable phase ofcoherent states which can be chosen from a regular discrete set ranging from binaryto continuous modulation, similar to phase–shift–keying in classical communication.Information is decoded by simultaneous homodyne measurement of both quadraturesand requires no active choice of basis. The protocol utilizes either direct or reversereconciliation, both with and without postselection. We analyze the security of theprotocol and show how to enhance it by the optimal choice of all variable parametersof the quantum signal.PACS numbers: 03.67.Dd, 42.50.Ex, 89.70.Cf oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying
1. Introduction
Quantum key distribution (QKD) is a procedure of information exchange between twoparties, the sender Alice and the receiver Bob, which allows to distribute absolutelysecure data between them (Gisin et al. 2002, Duˇsek et al. 2006, Scarani et al. 2009).The distinctive part of QKD with respect to classical communication is the use ofa quantum information channel, where the signal is protected from unauthorizedduplication (Wooters & Zurek 1982, Dieks 1982, Bennett & Brassard 1984, Ekert 1991).Mathematically, the information signal can be described by discrete variables (DV) orby continuous variables (CV) (Cerf et al. 2007), although physically the signal canbe of various kinds: single photons (Bennett & Brassard 1984), weak coherent pulses(Bennett 1992), squeezed states (Ralph 1999, Hillery 2000) and other systems where asignal possesses essentially quantum properties.A universal characteristic that can be compared for different QKD protocols (apartfrom their experimental realizations) is the secret key generation rate (shortly, keyrate ) — i.e. the average amount of secure information per elementary transmission(e.g. per light pulse). In order to transmit higher total amount of secure data onecan increase the pulse repetition rate or increase the key rate. The first way is limitedmainly by experimental techniques, while the second one is defined by mathematicalproperties of the given QKD protocol.In the case of DV QKD, it has been shown that extensions of the standardfour–letter BB84 protocol (Bennett & Brassard 1984) to higher number of lettersin the alphabet can improve performance in terms of higher critical error rate orlonger communication lines (Bruß 1998, Bechmann-Pasquinucci & Gisin 1999, Sychet al. 2004, Sych et al. 2005).In the case of CV QKD, the first protocols were based on Gaussian alphabetsconsisting of either coherent or squeezed states. The common weak point of theseprotocols is high sensitivity to losses in the quantum communication channel, whichinitially was believed to lead to the so–called “3 dB loss limit”: the key rate is equalto zero when channel losses are higher than 50%. After the invention of postselection(Silberhorn et al. 2002) and reverse reconciliation (Grosshans et al. 2003), this limit wasovercome, and the key rate was substantially improved. Another interesting option forimproving the key rate is to consider discrete alphabets (Namiki & Hirano 2003, Heid &L¨utkenhaus 2006) instead of Gaussian ones. Protocols with Gaussian alphabets have anadvantage of simpler security analysis, whilst the protocols based on discrete modulationare easier to realize in practice.In this work we address the question how one can further increase the key rate ofCV QKD with discrete modulation by varying the geometry of the quantum alphabet.Having in mind the idea of improving the properties of DV QKD by use of moresymmetric alphabets with higher number of letters (Sych et al. 2005), we present a newCV QKD protocol which generalizes previous ones with discrete modulation (Namiki& Hirano 2003, Lorenz et al. 2004, Heid & L¨utkenhaus 2006). Namely, the protocol oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying N coherent states | α k i = (cid:12)(cid:12)(cid:12) ae i πN k E which have relative phases πN k and a fixed amplitude a . In classical communication, this type of encoding is knownas phase–shift–keying (PSK). We perform a security analysis of the proposed protocolfor lossy but noiseless quantum channels, providing full optimization of all parametersof the protocol, and show how the number of letters affects the key rate.
2. Description of the protocol
An elementary information transmission in the multi letter PSK protocol is as follows: • The sender (Alice) chooses a random equiprobable number k = 1 . . . N and sendsthe respective coherent state | α k i = (cid:12)(cid:12)(cid:12) ae i πN k E . • The receiver (Bob) measures the state by splitting the signal at a 50/50 beamsplitter and measuring two conjugate quadratures ˆ x and ˆ p at the output ports byhomodyning each signal — such a scheme is called heterodyne measurement (Lorenzet al. 2004, Weedbrook et al. 2004), where the two conjugate measurements can beseparated in time or space. The results of the measurements are β x and β p , whichwe write as a pure coherent state | β i = | β x + iβ p i . • Bob assigns a classical number l to the measured state | β i by finding a state | α l i which is the closest alphabet’s state to the state | β i : | h α l | β i | = max n | h α n | β i | .Generally speaking, this classical value l decoded by Bob can be different from theinitial value k sent by Alice because of intrinsic quantum uncertainty even in theabsence of eavesdropping or any channel noise.The elementary information transmission from Alice to Bob can be schematically shownas a “ k → l ” channel: k encoding −→ | α k i measurement −→ | β i decoding −→ l. (1)As long as the considered quantum alphabet has a regular 2 π/N phase–shiftsymmetry, and all states have an equal probability to be sent, all channel inputs andoutputs (1) are equiprobable. We note, that there is no active choice of measurementbasis in our protocol, therefore there is no basis reconciliation needed. All transmissionscontribute to the total secure key, and nothing is discarded unlike in previous protocolswith discrete modulation and homodyne detection (Namiki & Hirano 2006).After the measurement, Bob can (but not necessarily has to) use the postselectionidea (Silberhorn et al. 2002), when he decides whether to keep the transmissiondepending on the value β . The elementary transmission (1), possibly followed bypostselection, is repeated until Alice and Bob collect enough data to perform classicalerror correction and privacy amplification procedures (Gisin et al. 2002). The resultingdata is a secret key.The amplitude a and the number of letters N can be flexibly adjusted for a giveninformation channel. The exact optimization for a given channel transmittance will bediscussed later. These parameters are supposed to be publicly known, particularly by oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying N → ∞ we have a continuous phase modulation. Thus our protocolcan be viewed as a smooth transition between discrete (Namiki & Hirano 2003, Lorenzet al. 2004, Heid & L¨utkenhaus 2006) and continuous (Silberhorn et al. 2002, Grosshans& Grangier 2002, Weedbrook et al. 2004) modulation of CV.
3. Security analysis
We investigate the security of our protocol assuming there is no excess noise in thequantum channel. In this case the best possible attack is the beam splitting attack(Heid & L¨utkenhaus 2006). We allow Eve to have unlimited access to all the losses, asshe could replace the real lossy information channel with an ideal lossless one.The beam splitting transformation is | α k i A → | β k i B ⊗ | ǫ k i E , where Alice’s initialstate | α k i is split to Bob’s state | β k i and Eve’s state | ǫ k i : | β k i = |√ ηα k i , | ǫ k i = (cid:12)(cid:12)(cid:12)p − ηα k E , (2)and η is the channel transmittance.In this beam splitting scenario, Eve does not introduce any excess noise on Bob’sside, whereas in any other better eavesdropping strategy Eve necessarily does. Forexample, if Eve would make an intercept–resend attack, then she adds at least one unitof shot noise. Afterwards, she can attenuate the signal, and the excess noise will beproportionally reduced. As a remark on the side, we see in this way, that the maximumtolerable excess noise cannot exceed that of the intercept–resend strategy, i.e. cannotbe higher then channel transmittance η .In real communication lines, such as optical fibres or free space, excess noise(typically, about 1% of shot noise (Lorenz et al. 2004, Lorenz et al. 2006, Elseret al. 2008)) is introduced mainly by imperfections of the experimental setup, and thereis almost no measurable excess noise due to the channel itself. If the absence of channelexcess noise is experimentally verified, then the eavesdropping strategy based on beamsplitting is the best possible attack, at least for the values of the channel transmittance η ≫ . The amount of classical mutual Shannon information I AB transmitted from Alice toBob via the channel (1) is equal to the difference of a priori (before measurement) and a posteriori (after measurement) entropies (Shannon 1948). Before any measurement,all channel outcomes are equiprobable for Bob, so his a priori entropy H priorBob is theunconditional “pure guess” entropy equal to log N bit per transmission.The conditional probability density to measure the state | β i when a state | α k i hasbeen sent is p ( β | k ) ∼ | h β k | β i | ∼ e −| β − β k | . The total unconditional probability density oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying | β i is p ( β ) = N N P k =1 p ( β | k ). Its normalization R p ( β ) dβ = 1 also yieldsthe normalization of p ( β | k ) = π e −| β − β k | . After the measurement of | β i , the probability p l ( β ) that the state | α l i was initiallysent is p l ( β ) = p ( β | l ) N p ( β ) = 1 πN p ( β ) e −| β − β l | . (3)As we discussed above, the measured state | β i is decoded by Bob to a classical value l such that the state | α l i is the closest alphabet’s state to the measured state | β i .Corresponding regions in the phase space are shown by different shades of grey in Fig. 1.In the case when l = k the value (3) is the probability of decoding the correct result,otherwise (3) is the error probability of decoding a wrong result l = k .Bob’s a posteriori entropy H postBob is the Shannon entropy of the total probabilitydistribution P ( β ) = { p ( β ) , p ( β ) , . . . , p N ( β ) } conditioned on the measured state | β i : H postBob [ P ( β )] = − N X k =1 p k ( β ) log p k ( β ) . (4)Finally, the amount of classical information transmitted from Alice to Bob via thechannel (1): I AB = Z p ( β ) I AB ( β ) dβ, (5)where I AB ( β ) = log N + N P k =1 p k ( β ) log p k ( β ). To calculate Eve’s potential information we consider two strategies of classicalcommunication between Alice and Bob during the post processing step: directreconciliation and reverse reconciliation. In the first strategy Alice sends correctinginformation to Bob, and in the second one Bob sends it to Alice. We also assume,that after the beam splitting Eve is not restricted to any practical way of informationextraction from this state, thus her potential knowledge is bounded by the Holevoinformation (Holevo 1973). In the general case, the Holevo information χ sets theupper bound on the information which can be transmitted by a state randomly chosenfrom a set of N states ˆ ρ k with a respective probability p k : χ = S N X k =1 p k ˆ ρ k ! − N X k =1 p k S ( ˆ ρ k ) , (6)where S ( ˆ ρ ) is the von Neumann entropy S ( ˆ ρ ) = − Tr ˆ ρ log ˆ ρ . oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying In the direct reconciliation case, Eve has a state (2)conditioned only on Alice’s sent state | α k i . Eve’s conditional state is pure, thus herinformation is equal to the von Neumann entropy I AE = S ( ˆ ρ E ) of her unconditionalstate ˆ ρ E = N N P k =1 ˆ ρ k .To calculate S ( ˆ ρ E ) we need to find the eigenvalues of ˆ ρ E . The rotational symmetryof the phase–shift alphabet allows us to write Eve’s conditional states in an orthogonalbasis {| m i} as (Chefles & Barnett 1998): | ǫ k i = N X m =1 c m e i πN km | m i . (7)In the basis {| m i} Eve’s unconditional state takes the diagonal form:ˆ ρ E = 1 N N X k =1 | ǫ k i h ǫ k | = N X m =1 | c m | | m i h m | , (8)so Eve’s information is equal to I AE = S ( ˆ ρ E ) = H [ C ], where H [ C ] is the Shannonentropy (4) of the probability distribution C = {| c | , | c | , . . . , | c N | } .The coefficients | c m | are derived from a system of N linear equations enumeratedby an index k = 1 . . . N : N X m =1 e i πN km | c m | = h ǫ N | ǫ k i . (9)It has a formal analytical solution | c m | = 1 N N X n =1 e − i πN mn − a (1 − η ) „ − e i πN n « , (10)where the coefficients c m depend on the signal amplitude a and the channeltransmittance η . In the case of reverse reconciliation Eve has a state(2) conditioned on Bob’s measured state | β i . After classical communication Evecan possibly find out the amount of information (5) between Alice and Bob in eachtransmission, so we assume this value is publicly open. Additionally we assume thatBob announces the amplitude of the measured state, so Eve knows the measured state | β i up to a cyclic phase shift 2 π/N . We denote these possible states as (cid:12)(cid:12) β ( l ) (cid:11) . On herside, Eve has to distinguish between the states ˆ ρ ( l ) E = P k p k ( β ( l ) ) | ǫ k i h ǫ k | .After averaging, Eve’s state is N P l ˆ ρ ( l ) E = ˆ ρ E , so the left entropy term in (6) isthe same as we calculated before for the case of direct reconciliation. Due to the 2 π/N phase–shift symmetry of the alphabet, the averaging in the right entropy term in (6) isjust equal to the entropy of any of the states ˆ ρ ( l ) E , let it be the first one ˆ ρ (1) E .Again, we can rewrite Eve’s states | ǫ k i in the orthogonal basis (7).Unfortunately, the state ˆ ρ (1) E in this basis takes a non–diagonal form ˆ ρ (1) E = oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying P k,m,n p k ( β (1) ) c m c ∗ n e i πN k ( m − n ) | m i h n | . We analytically calculate eigenvalues of this statefor a given N , but the result is too large to be presented here. Finally, Eve’s informationis I BE ( β ) = S [ ˆ ρ E ] − S [ ˆ ρ (1) E ]. The key rate G , i.e. the amount of secret information per transmission (1), is equal to thedifference between Bob’s and Eve’s informations (Devetak & Winter 2005, Renner 2007): G = Z p ( β ) G ( β ) dβ, G ( β ) = I AB − I AE,BE . (11)where I AE and I BE refer to direct and reverse reconciliation respectively. Figure 1.
Reconciliation and postselection areas for 5 letter protocol. Different shadesof grey correspond to the regions in the phase space where measurement results | β i are associated with a given letter. Letters are shown as black circles. Dashed linesshow the borders of the postselection areas for a case when amplitude is a = 1 .
4, andtransmittance varies from 0 .
95 (the smallest area) to 0 . . In the case of direct reconciliation, Eve has to guess what was sent by Alice. Ifthe channel transmittance is lower than 50%, Eve can potentially have a better signalthan Bob, thus Eve’s information can be higher than Bob’s information and no securecommunication is possible. To overcome this “3 dB limit” we use the postselection idea(Silberhorn et al. 2002), so that Bob has an information advantage over Eve ( I AB > I AE ),i.e. we select only that part of transmissions which give us positive terms G ( β ).The postselection procedure in the direct reconciliation scenario can be qualitativelydescribed as follows: Eve’s information I AE does not depend on Bob’s measured state β , so the key rate can be increased if Bob accepts only those transmissions where β issuch that he has higher information than Eve ( I AB ( β ) > I AE ). Instead of integration oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying G P S = Z P SA p ( β ) ( I AB ( β ) − I AE ) dβ. (12)To find this PSA we numerically solve an equation I AB ( β ) > I AE . As an example inFig. 1 we show the borders of the PSA for 5 letter protocol as the dashed lines. Differentdashed lines correspond to different values of transmittance η = 0 . , . , . , . . . , . a = 1 .
4. The PSA is the phase space except the centralregion bounded by a dashed line. If the measured state | β i lies inside the region thetransmission should be omitted, otherwise it is accepted. The higher the transmittance,the smaller the omitted region, the bigger the PSA, and the higher the key rate (12).To find the key rate G P S as a function of transmittance η we optimize the amplitude a such as to maximize the key rate G P S ( η ) = max a G P S ( η, a ).In the case of reverse reconciliation, Eve has to guess Bob’s measurement result,thus her information cannot be higher than Bob’s information: I AB ≥ I BE . Therefore, G ( β ) is always nonnegative, and the postselection procedure does not have to be applied.
4. Results
The calculated secret key rate G P S ( η ) and the optimal amplitude a ( η ) for severalalphabets are shown in Fig. 2 ‡ . We can see, that for the channel transmittance η < . ∞ –letter alphabet, but its approximation by a high number of letter confirms thatthis is the best choice for all values of η . The key rate is higher than for the 2–letteralphabet of almost an order of magnitude.In the case of direct reconciliation, we can see that lines G ( η ) for various numbersof letters are intersecting in different points, which are presented in Table 1. This meansthat for different values of transmittance η there are different optimal numbers of letters.The higher the transmittance, the higher the optimal number of states. Table 1.
Values of transmittance η , where a curve G P S ( N, η ) intersects with a curve G P S ( N + 1 , η ). N 2 3 4 5 6 7 8 η ‡ Discontinuity of the curve a ( η ) for the 5–letter alphabet is not a mistake. Due to the fact that thefunction G ( a ) at a fixed value η can have two slightly different global maxima, the exact optimizationfor variable η may cause a “jump” from one maximum to another. oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying l og G η2345678 Numberof letters a η2345678 Numberof letters
Figure 2.
The secret key rate G in logarithmic scale (upper plot) and optimal signalamplitude (bottom plot). Solid and dashed lines correspond to direct and reversereconciliation, respectively. Again, we don’t have have an analytical expression for the curve G ( N = ∞ , η ), butwe found that left side of the curves quickly saturates (there is no essential differencebetween G ( N = 5 , η ) and G ( N = 64 , η ) for η < . ∞ letters. A curve G ( N = ∞ , η ) intersectswith G ( N = 4 , η ) at the value η ≃ . a must be small, and Bob relies basically on the postselection. Inpostselection it is harder for Bob to distinguish between many letters than betweentwo. Thus with an increasing number of letters his information essentially decreases. In oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying η → N bit per transmission. Therefore, the more letters in the alphabet are, the higher Bob’sinformation is. In principle, one can use an arbitrary high number of letters, and in thelimit N → ∞ (continuous phase modulation) Bob’s information seems to be infinite.However, there are limiting factors from both experimental and theoretical viewpoints.First, as one can see in Fig. 2 the curves G ( η ) and a ( η ) start to essentially increase fromthe values η > .
99. In any real experimental setup there are imperfections (inaccuracy,losses, etc.), so the case η > .
99 can hardly be achieved. Second, any real signal hascertain energy limit, which sets maximum amplitude. Also taking into account excessnoise in the channel might somewhat change the situation.
5. Conclusions
To summarize, we have presented a new CV QKD protocol with coherent states. Theprotocol employs multi letter phase–shift–keying and heterodyne measurement. Securityanalysis of the proposed protocol is performed for the case of lossy but noiseless quantumchannels. We have shown that for each given channel transmittance one can find acertain optimal number of letters (2, 3, 4, or ∞ ), optimal amplitude of the signal(typically, 1 to 4 photons per pulse), and optimal postselection threshold, which increasethe secret key rate about one order of magnitude comparing to the protocol with binarymodulation. Acknowledgments
The authors thank Norbert L¨utkenhaus for helpful discussions, Dominique Elser andChristoffer Wittmann for valuable comments on the manuscript. D.S. acknowledges theAlexander von Humboldt Foundation for a fellowship.
Bibliography
Bechmann-Pasquinucci H & Gisin N 1999
Phys. Rev. A , 4238 – 4248.Bennett C H 1992 Phys. Rev. Lett. , 3121 – 3124.Bennett C H & Brassard G 1984 in ‘Proceedings IEEE Int. Conf. on Computers, Systems ad SignalProcessing’ IEEE New York p. 175.Bruß D 1998 Phys. Rev. Lett. , 3018 – 3021.Cerf N J, Leuchs G & Polzik E 2007 Quantum Information with Continuous Variables of Atoms andLight
Imperial College Press.Chefles A & Barnett S M 1998
Phys. Lett. A , 223–229.Devetak I & Winter A 2005
Proc. R. Soc. London Ser. A , 207.Dieks D 1982
Phys. Lett. A (6), 271. oherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying Duˇsek M, L¨utkenhaus N & Hendrych M 2006
Progress in Optics , 381–454.Ekert A K 1991 Phys. Rev. Lett. , 661 – 663.Elser D, Bartley T, Heim B, Wittmann C, Sych D & Leuchs G 2008 arXiv:0811:4756 .Gisin N, Ribordy G, Tittel W & Zbinden H 2002 Rev. Mod. Phys. (1), 145.Grosshans F, Assche G V, Wenger J, Brouri R, Cerf N J & Grangier P 2003 Nature , 238.Grosshans F & Grangier P 2002
Phys. Rev. Lett. , 057902.Heid M & L¨utkenhaus N 2006 Phys. Rev. A , 052316.Hillery M 2000 Phys. Rev. A , 022309.Holevo A 1973 Probl. Inf. Trans. , 177.Lorenz S, Korolkova N & Leuchs G 2004 Appl. Phys. B: Lasers Opt. , 273.Lorenz S, Rigas J, Heid M, Andersen U L, L¨utkenhaus N & Leuchs G 2006 Phys. Rev. A , 042326.Namiki R & Hirano T 2003 Phys. Rev. A , 022308.Namiki R & Hirano T 2006 Phys. Rev. A , 032302.Ralph T C 1999 Phys. Rev. A , 010303.Renner R 2007 Nature Physics , 645 – 649.Scarani V, Bechmann-Pasquinucci H, Cerf N J, Duˇsek M, L¨utkenhaus N & Peev M 2009 Rev. Mod.Phys. (4), 1301.Shannon C 1948 Bell Syst. Tech. J. , 379.Silberhorn C, Ralph T C, L¨utkenhaus N & Leuchs G 2002 Phys. Rev. Lett. (167901).Sych D V, Grishanin B A & Zadkov V N 2004 Phys. Rev. A , 052331.Sych D V, Grishanin B A & Zadkov V N 2005 Quant. Electron. , 80.Weedbrook C, Lance A M, Bowen W P, Symul T, Ralph T C & Lam P K 2004 Phys. Rev. Lett. , 170504.Wooters W K & Zurek W H 1982 Nature299